Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Android may send data unencrypted over cellular

CVE-2023-21219 · published 3 years ago
Summary

On some Android devices the default setting can cause data to be transmitted without encryption when using a cellular connection. This allows anyone on the network to intercept the information without needing any special access or user interaction. Apply the latest software update or change the network settings to require encrypted communication.

What to do
  • Update google :unknown: to version Pixel-family specific:2023-06-05.
Affected software
Ecosystem VendorProductAffected versions
Android google :unknown: >= Pixel-family specific:0, < Pixel-family specific:2023-06-05
Fix: upgrade to Pixel-family specific:2023-06-05
– google android All versions
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Original advisory text
there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges ne...
there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published1 Jun 2023
Updated4 Nov 2026
First seen15 Apr 2026
Sources
PUB-A-264698379 · OSV
CVE-2023-21219 · NVD
Track software like this
Free during beta